Using CORSConfig and setting max_age affects all requests, not just OPTIONS

Reproduction steps:

Create a custom cors config and set the max_age:
`customCors = CORSConfig(
allow_origin="*",
max_age=86400
)`

Now use that in a route:
`@app.route('/users/{userId}', methods=['GET'], cors=customCors)`

As expected, the OPTIONS calls get cached because the response header sets `Access-Control-Max-Age` properly. However, the GET call to /users/{userId} also includes Access-Control-Max-Age in the response headers, which is not expected behavior. Shouldn't that only be set on the OPTIONS response?

Start by tracing CORSConfig, especially max_age, through the route entry point shown in the reproduction. Reproduce the /users/{userId} GET and OPTIONS requests and compare their response headers. Done means Access-Control-Max-Age is present on the OPTIONS response but not on the GET response, with regression coverage for both methods.

Written by the indexing model from the issue text.